Nostra Starknet oracle exploit pauses money market, $3.5M borrowed

Nostra paused its Starknet money market on Thursday after a manipulated NSTR price oracle let one account borrow $3.5 million against NSTR collateral. Lending, borrowing, withdrawals and liquidations stay unavailable while the team reconciles each asset. Nostra said it is still tracing the funds, and that the final loss and potential recoveries are not yet known.

The attacker pledged NSTR and drew ETH, STRK, USDC, USDT, WBTC and DAIv1 from the money market. NSTR's entire market value sat at $546,751, so the haul ran roughly six times the size of the collateral token itself. PeckShield reported the attacker bridged $1.92 million of the proceeds to Ethereum, in 234.57 ETH and 1.3 million DAI.

What's paused, and what isn't public

Lending, borrowing, withdrawals and liquidations on Nostra stay frozen while the team reconciles positions across each asset. Total value locked fell from $4 million on September 16 to roughly $710,632 at the time of the incident, per DefiLlama. On-chain transaction hashes for the borrow call or the Ethereum bridge have not been published, and the protocol's contract address and the attacker wallet are not yet in the public record.

The $3.5 million borrowed and $1.92 million bridged are the only dollar figures in circulation; no protocol loss number has been published. Nostra has warned users impersonators, and said it will never send direct messages or ask holders to connect a wallet during recovery.

Starknet's second oracle hit in two weeks

Nostra is the second Starknet protocol hit by an oracle failure this month. On September 4, an incorrect price from oracle provider Pragma's publishing pipeline went out across several Starknet feeds and triggered 47 liquidations across 42 borrower wallets on money market Vesu. Pragma reported 95% asset recovery from that incident in a September 13 update. The two causes differ: Pragma's was a publishing fault, Nostra's was deliberate manipulation of a collateral price.

September's running tally

DefiLlama had logged more than $326 million in crypto losses this month before Nostra, with most of it from a $320 million Liquid Network incident. The Nostra borrow sits inside the 2026 pattern PeckShield has flagged in its August count: 50 hacks, the highest monthly tally of the year, with total losses down 49.5% to $136.3 million. Frequent, smaller thefts are now the typical shape of a crypto month.

Lagarde personally blocked Binance's EU MiCA license, report says

ECB President Christine Lagarde reportedly asked Greek PM Mitsotakis not to approve Binance's MiCA license. Binance withdrew its Greek filing on June 24, 2026, a week before the EU's July 1 deadline, leaving its French entity unable to offer spot, margin, or futures trading.

Nadex became a US exchange for stock futures via Sept. 14 filing

Crypto.com's futures venue Nadex became a US-registered national securities exchange for security futures products the moment it filed Form 1-N on Sept. 14, 2026. Section 6(g) of the Securities Exchange Act made the filing equivalent to registration, with no SEC vote.

US sanctions Tehran's BitBank over bitcoin transfers to IRGC

OFAC designated Tehran-based BitBank on Thursday under Executive Order 13902, saying the exchange moved hundreds of millions of dollars in bitcoin to Iran's IRGC between June and July.